Missing dependency hono

[artola]

Describe the bug
The package has as dependency @hono/node-server which requires as peerDependency hono.
This one is not installed, neither listed as a required peerDependency of this package.

To Reproduce
Steps to reproduce the behavior:

1. Use a package manager as Yarn (it does not install automatically peers) and after yarn install run yarn explain peer-requirements:

p255768 → ✘ @modelcontextprotocol/sdk@npm:1.25.3 [56a1a] doesn't provide hono to @hono/node-server@npm:1.19.9 [b19b5]

Expected behavior
hono is declared as dependency of this package or listed as peerDependency (might be even optional?) to make it explicit to the consumers.

Logs

➤ YN0000: ┌ Post-resolution validation
➤ YN0086: │ Some peer dependencies are incorrectly met by dependencies; run yarn explain peer-requirements for details.
➤ YN0000: └ Completed

Additional context
Used latest 1.19.9

[shinpr]

This also has security implications.

Since hono isn't declared as a dependency, Dependabot doesn't track its vulnerabilities in this repo—CVE-2026-22817 (CVSS 8.2, published Jan 13) doesn't show up in the security tab here. Meanwhile, downstream users do get alerts and have to deal with it themselves via pnpm update or overrides.

Adding hono as a direct dependency would fix both the peer warning and the security monitoring gap.

[KKonstantinov]

Hi,

This should already be fixed on the v1.x branch (https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.x/package.json) but not released yet, to be released soon